EAP-TLS connection rejected by server: "no such user", client says association timed out

[Adam Monsen]

Got it. I had to add change "key_mgmt" to "WPA-EAP", then add
"pairwise=CCMP" and "group=CCMP" to the network block. Final working
config:

  ctrl_interface=/var/run/wpa_supplicant
  network={
    ssid="THEIRSSID"
    scan_ssid=1
    key_mgmt=IEEE8021X
    pairwise=CCMP
    group=CCMP
    eap=TLS
    identity="ubuntu.wifi.local.place"
    ca_cert="/opt/wifi/root.crt"
    client_cert="/opt/wifi/client.pem"
    private_key="/opt/wifi/encrypted.key"
    private_key_passwd="(REDACTED)"
    eapol_flags=3
  }